1. Field of the Invention
This invention concerns a network architecture that enforces desired security policies with respect to the flow of information on secure networks.
2. Discussion of the Known Art
Information networks for use by the government and the military typically carry sensitive information that must be confined among individuals who have proper security clearances and a need to know. Multi-level security (MLS) concerns the ability of a network or computer system to handle messages that are classified as, for example, top secret (TS), secret (S) or confidential (C), as well as unclassified (U) messages. A MLS network typically allows higher-cleared individuals to access less-sensitive information.
U.S. Patent Application Publication No. 2004/0225883 (Nov. 11, 2004) concerns a method of providing multiple single levels of security (MSLS) in a communication system. The publication discloses an arrangement for enforcing system access policies by way of controlling hardware. Currently, solutions for providing embedded security in communication networks by way of software (as opposed to hardware) allow for greater flexibility.
A network architecture known as Multiple Independent Levels of Security (MILS) has been created to facilitate the development of MLS networks that can be certified as meeting the highest current standards, namely, Evaluation Assurance Levels (EALs) 5-7. See W. S. Harrison, et al., “The MILS Architecture for a Secure Global Information Grid”, Journal of Defense Software Engineering (October 2005) at pages 20-24, which is incorporated by reference. MILS architecture partitions security enforcement into three layers, viz., the kernel, middleware, and application. As used herein, middleware refers to software that provides interoperability between an operating system and an application on a network. Examples include the known common object reference broker architecture (CORBA), and file systems.
The MILS architecture provides a structured approach to data separation and information flow control. The architecture facilitates proof in correctness of design of security mechanisms at various levels, by partitioning security enforcement into the three mentioned layers. See W. M. Vanfleet, et al., “Deeply Embedded High Assurance Multiple Independent Levels of Security, Real Time OS and Middleware Architecture” (slide presentation; Sep. 9, 2002).
The basic component of MILS architecture is the separation kernel (SK) which serves to separate processes or applications on a processor, and their resources, into isolated spaces sometimes known as partitions or process spaces. The separation kernel enforces data isolation and information flow control on each node. As used herein, “node” refers to a single hardware processor. The SK uses the processor's memory management unit to provide the process separation. The SK also uses inter-process communication (IPC) mechanisms such as shared memory or messaging, to provide information flow control on any given node (but not between partitions on separate processors). On a single processor system, little or no middleware is required to provide security enforcement.
For a network with more than one processor node, more complex middleware is required to enforce a data isolation and information flow control policy for the network. One particular approach to the multi-node middleware problem was disclosed by Bill Beckwith, “MILS Middleware: Status Update”, Objective Interface Systems, Inc., Open Group Meeting, Security for Real-Time (slide presentation) (January 2004), discussing requirements for a partitioned communication system (PCS) designed for EAL 7 certification. The PCS approach relies on the kernel to enforce a network's information flow policies by way of a MILS message routing (MMR) component. The main function of the MMR is to open a communication path between applications in different partitions, but only if such communication is permitted by the flow policies of the network. The PCS approach is aimed at controlling network message routing at the CORBA level only. A PCS also requires encryption services to provide middleware protection between processors, and the kernel is relied upon to provide the middleware access control functionality.
Network security information flow control policies may include any of the following; viz., discretionary access control (DAC), mandatory access control (MAC), and integrity access control. Network security models typically use the terms “subjects” and “objects”. Subjects are defined as active agents in a computer system, for example, live users, processes, and other computers. Objects refer to containers of data which can be acted upon by the subjects. Examples of objects include databases, file systems, and memory locations.
DAC defines certain access control policies for objects (e.g., files or databases), which policies may be set at the discretion of the object owner. The controls are discretionary in that the owner may permit access to the object directly or indirectly by other specified subjects. These access permissions are generally applied to users, but may be extended to apply to any subject in the network or system.
By contrast, MAC provides label-based access control according to hierarchical and non-hierarchical characteristics of both the subject and the object. If the label of a given subject dominates the object (e.g., is of a higher classification), then information originating from the object may flow to the subject. This is referred to as the Bell and La Padula security model, which permits “read down” and “write up” requests, while blocking requests to “read up” and “write down”. The model requires that (1) a subject at a given security level may only read data from objects at the same or a lower security level, and (2) a subject at a given security level may only write data to objects having the same or a higher security level.
Integrity concerns a level of confidence or trust that may be placed in a subject or an object (e.g., an application) on the network. For example, the higher the level of integrity for a given application, the more confidence a subject may have that the application will execute properly. Likewise, data having a higher integrity level is known to be more accurate (i.e., reliable) than data of a lower integrity level. Network integrity may be defined, for example, by way of the so-called BIBA integrity model which permits information to flow from a higher integrity process to a lower integrity process, and, like MAC, may also be label-based.